SB2019013141 - Fedora 28 update for pdns-recursor

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019013141

SB2019013141 - Fedora 28 update for pdns-recursor

Published: January 31, 2019 Updated: April 24, 2025

Security Bulletin ID SB2019013141
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Security restrictions bypass (CVE-ID: CVE-2019-3807)

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to records in the answer section of responses received from authoritative servers with the AA flag not set were not properly validated. A remote attacker can bypass DNSSEC validation.


2) Security restrictions bypass (CVE-ID: CVE-2019-3806)

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to Lua hooks are not properly applied to queries received over TCP in some specific combination of settings. A remote attacker can bypass security policies enforced using Lua.


Remediation

Install update from vendor's website.

References